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Executive summary 


Policymakers, law enforcement, regulators and the private sector 
have all taken important steps to protect the citizens that they 
serve and the economies in which they operate through significant 
investment in people, processes, and technology. Despite this, it has 
continued to be difficult to effectively stem the flow of illicit finance. 


In this paper, the Institute of International Finance (IIF) and Deloitte 
Transactions and Business Analytics LLP (“Deloitte”) highlight four 
areas of focus where continued reform could build on the good 
work and progress already underway globally to help improve 

the effectiveness of the anti-financial crime framework: 1. the use 
of financial intelligence; 2. risk prioritization; 3. technology and 
innovation; and 4. international cooperation and capacity building. 


This paper also highlights important instances of ongoing systemic 
improvements, how similar efforts can be deployed across 
jurisdictions, and how policymakers could prioritize international 
cooperation and coherence. Strong global leadership is vital, 

as is a continued commitment from all stakeholders to take 

an empowered, proactive, collaborative and outcome-focused 
approach to tackling financial crime. Only by working collectively 
as a coordinated international system can public and private 
stakeholders truly address, and ultimately prevent, domestic and 
cross-border financial criminality. 
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cursion into the international 


financial system is a global problem requiring a coordinated, wide- 


reaching response and a clear 
framework for fighting financia 
to be done at all levels to help i 


public pol 


icy focus. An effective 
crime is essential and more needs 


dentify and stem the flow of illicit 


finance which supports malignant activities such as terrorism, 


sexual exploitation, human 


crime, drug smuggling, and cybercrime. 
integrity of 
th increasingly complex and international 


between the 
system 


connection 


the financial -wi 


tra 


ficking, fraud, environmental 
There is also an inherent 
finance and the stability of 


criminal activity being a factor that significantly undermines cross- 


border financial strength. ' 


In 2019, the IIF and Deloitte UK laid a way forward on mitigating 


illicit 


flows through a combination of internationally consistent 


regulatory reform and an intelligence-led approach to financial 
crime risk management.? The 2019 paper identified seven key 


enab 


ers to amore effective system through a process which 


canvassed financial institutions (FIs), policymakers, regulators and 
law enforcement across Europe, Africa, the Americas, Asia, and 


the 


iddle East. Those enablers included a focus on information 


exchange, public/private cooperation, and systemic reform with an 
emphasis on achieving better outcomes. 


to gauge current 
ndustry and the 
challenge facing the 
the IIF and Deloit 
of stakeholders at F 


Since then, noteworthy progress has been made around the world 
across those issues, building on 
by the Financial Action Task Force 
of the public and private sectors to 
crime is identified, mitigated, and ul 
perspectives from 
public sector on that progress and the continued 
global financial 
te US have combined 
s and public au 
oney Laundering and Countering t 


years of good work spearheaded 
FATF) and the collective efforts 
improve the way financial 
timately prevented. In order 
within the financial services 


crime risk management regime, 
research with interviews 
thorities responsible for Anti- 
Financing of Terrorism 


(AML/CFT) and the wider financial crime policy and enforcement 
environment across both developed and emerging markets. 


The result of that research 
aims to present a global ou 
crime ris 
view on how to continue to 
the framework for mitigatin 
system. With the impact o 
challenges in relation 


process is d 


tloo 


enh 
gth 


fthe 
o financial crime activity,? wi 


istilled in this paper and 
on the current state of financial 


management and compliance, as well as an updated 


ance the overall effectiveness of 
e criminal misuse of the financial 
COVID-19 pandemic raising novel 
th new risks 


emerging (including, notab 
pub 


y, th 


icly funded climate finance initiatives and con 


e potential for criminal abuse of 
tinued public 


sector investment in pandemic recovery programs), and with 
numerous financial crime compliance reform efforts across the 


globe, there is fresh opportunity to explore how to address factors 
that prevent the optimum means of tackling systemic financial 


cri 


me issues by leveraging sound practices, and 


international coordination. 


addressing gaps in 


There are a number of the potential approaches laid out in this 


stakeho 
sti 


implementa 
jurisdictions. 


As such, Part 1 of this paper lays out examples o 


paper that are already being considered and/or developed by 
ders, albeit at varying levels of maturity, 
ll to be considered. Thi 


and some are 


S paper could also, therefore, assist in 
encouraging firms, regulators, policymakers, and 
agencies to accelerate th 


law enforcement 


ese reforms within their respective 
tion programs and to work to align e 


fforts across 


f noteworthy 


reform efforts at the international, regional, and domestic levels. 


Part 
the 
eh 
2. Ri 


3. Technology and innovation 


4, Internationa 


Thi 


‘iri 


financial cri 


S paper high 


fthe 


ationa 


cooperation and capacity building 


lights important instances of sys 
improvements that are ongoing, how similar efforts can be 
deployed across juri 
prioritize intern 
is recognized that the 


sdictions and how policyma 
cooperation and coheren 
financial crime framework 


2 provides considerations on how to make further progress in 
following key areas, considering these reform efforts: 

he use of financial intelligence 
sk prioritization 


temic 


ers can better 
ce. While it 


s in different 


sdictions are at different levels of maturity, th 
homogeneity o 


e globa 


drivers, effects and solutions concerning 

me warrant a sustained, collective focus by the world 
community to continue to deliver outcomes which 
isuse of finance and 
inancial stability. 


stop the criminal 


its subsequent damage to society and 


There is an urgent need for efforts in this policy area. Though 
reform processes m 


appropriate amount 


are assuaged, 
moves at a 


the cr 


rate whic 


initiatives. As has be 


was key to add 


behavior. Li 


the opportuni 
significant ri 


expeditious and dyn 
crime architecture to mitigate threats in a more efficient manner. 


ust be carefully considered and should take an 
of time to ensure any negative consequences 
iminal element in international finance 

h can outpace many well-intentioned policy 
en seen during the COVID-19 crisis, speed 
ressing changing methods and 
ewise, technological developmen 
policymakers do not 
ties an 


modes of criminal 
ts move quickly. If 
have a full picture of new developments and 
d the threats they may create, then there is 
sk that policy reform will fall short 
effective. There needs to be a continued focus on delivering 
amic improvements to the global anti-financial 


or only be briefly 
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Part 1: The global outlook 
on financial crime risk 
management reform 


The focus on efforts to improve AML/CFT and the broader financial 


crime ecosystem have been at the forefront of policymaking for 
decades. The FATF was established as an inter-governmental 


organization 
body in setting globa 


for combating money laundering a 
such as MONEYVAL, the Asia-Pacifi 
(APG) and the Eurasian 
and application of the FATF Recom 
have combined with the work of th 
domestic rules and ensure interna 


Units (FIUs) 
through such fora as Interpol and 


rime risk management frammewor 


On EF a S 


from the collective 
to be guided by fundamenta 


standards an 


Group suppor 


implemented. International collaborat 
through the Egmont Group and law enforcement work 

Europol actively engage in efforts 
which target emerging risks across the globe5 


cG 


tion 


over thirty years ago and has been the leading 

d promoting effective 
implementation of legal, regulatory, and operational measures 
nd terrorist financing. Bodies 


roup on Money Laundering 


t multilateral 
mendations.’ National efforts 
e€ private sector 


al standards 


on of Financi 


s through upda 


cooperation 


to strengthen 
are effectively 
al Intelligence 


n addition to this sustained, long-term focus, it is important to 
ote that a number of additional efforts are currently underway 
t the global, regional, and national levels to modernize financial 


tes to domestic 


nd multilateral regimes. The drivers of such efforts often come 
understanding that effective ou 
reform through enab 


tcomes need 
ers of a better 


system. These enablers continue to include, among others, 
enhanced information exchange, public/private cooperation, 
the use of technology, and the coherent implemen 


international standards. 


e) 


tation of 


While Part 2 of this paper looks at a way forward to enhancing 
effectiveness in financial crime risk management through such 
enablers, the following examples of recent reforms (and/or 
reforms that are underway), highlight the collective importance 

f addressing both the fundamental building blocks of risk 
management and the need to find innovative solutions for tackling 


financial crime. The opportunities presented herein to coordinate 


reform efforts and address sound 


practices across jurisdictions 


- and through international bodies — are referenced across this 
paper and should be a priority to potentially avoid fragmented 


approaches to these issues, which 
terrorist financiers. 


can be exploited by criminal and 


1. International standard setting bodies: 


At the global level, the internati 


onal standard-setting bodies 


(e.g., the Basel Committee on Banking Supervision, the 
Committee on Payments and Market Infrastructures (CPMI), 
and the FATF continue to set requirements and provide 


guidance to help drive internat 
worldwide anti-financial crime 


During the two-year German p 
has prioritized countering mon 
smuggling, environmental crim 


ional consistency in the 
framework. 


residency of the FATF, the body 
ey laundering and migrant 
e, illicit arms trafficking and the 


financing of ethnically- or racia 


broadly, the FATF has set important targets around digital 
transformation of AML/CFT - includi 


privacy and data pooling - add 
transparency, tackling 


standards, and continuing to follow 
things, recommendations and guidance around prolifera 
asset service providers (VASP) and 


of financing risk, virtua 


ly-motivated terrorism.° More 


ng issues around data 
ressing beneficial ownership 


unintended consequences from the FATF 


through on, among other 
tion 


the application of risk-based supervision. Work on enhancing 
the effectiveness of implementation of FATF measures 


continues, and a FATF Global N 


etwork assessment process iS 


ongoing, which presents valuable opportunities for improving 
international coherence in standards. FATF has also increased 


its 


focus on ensuring the effectiveness of AML/CFT regimes. 


The Financial Stability Board (FSB), CPMI and the Basel 


Committee, as well as the FATF, 


, are working on an ambitious 
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roadmap at the behest of the G20 to enable “faster, cheaper, 
more transparent, and more inclusive cross-border payment 
services.”’ As part of the building blocks on how payment system 
enhancements could be achieved, these bodies are considering 


issues for applying AM 


L/CFT rules consistently internationa 


ly, 


fostering Know-Your-Customer (KYC) and identity information- 


sharing and, in conjunction with AML/CFT requirements, 
reviewing the interaction between data frameworks and 
protection. This effort holds promise in not on 
cross-border payment 
to de-risking and positi 
issues which prevent a 


framework. 


The Basel Committee has also amen 
management of risks related to mon 


s but also in addressing structural dri 
vely impacting many of the anci 
fully effective global anti-financia 


data 
ly enhancing 
vers 
lary 


cri 


me 


ded its guide Sound 
ey laundering and financing 


of terrorism, enabling greater interaction, cooperation, and 


information exchange between 
supervisory authorities.® This g 
assist in filling gaps in this area, 
facilitate such cooperation in the 


context. 


United States: In the United Sta 
consensus among regulators, legi 
industry that compliance with A 
the amendments passed after 


ie) 


A 


inc 


bally 
udi 


tes (US), there is a growing 
slators, law enforcement, and 
L/CFT req 
the Bank Secrecy Act (BSA), 


L/CFT and prudential 


consistent guidance can 
ng the mechanisms which 


jurisdictional and international 


uirements, including 


has evolved into a layered and inefficient system that does not 


serve the need 


resulted in regu 
do little to mitigate the risks associated wi 
6, 2020, the Financial Cri 
Network (FinCEN) signaled the s 
fundamentally reform the AML/CFT regime 
Rulemaki 
Effectiveness.? The ANPRM introduced a proposed 
L program effectiveness, 
AML Priorities, and a possible regulatory requirement for ris 


On September 


an Advance No 
Program 


definition of AM 


assessments. 


On January 1, 2021, the AML Act of 2020 (USA 


and reinforced 


s of law enforcem 
ated Fls spendi 


tice of Proposed 


and codified a ris 


ent. In many instances, this has 
ng time on activities that may 


th financial crime. 
mes Enforcement 


tart of a multi-year effort to 


in the US through 
ng (ANPRM) on AML 


the concept of Strategic 


LA) became 


-based approach for AML/ 


CFT programs. For instance, the US AMLA required FinCEN 


to estab 


As required by 
the first govern 
publication of t 


CFT programs 


the primary focus of US reg 
from maintaining 


ish national AML/CFT pr 


the US AMLA, on J 
ment-wide nation 
he priorities is a si 


alA 


gnificant step 
ulators and Fls concerning AML/ 
techn 


iorities for Fls to incorporate 
them into their AML/CFT programs, and for regulators and 
examiners to incorporate into rules, guidance, and examinations. 


une 30, 2021, 


FInCEN issued 
L/CFT Priorities. The 
forward in shifting 


ical compliance to a more 


risk-based, innovative, and outcomes-oriented approach to help 
combat financial crime and safeguard national security in the 


evolving financial environment. 


European Union: The European Union 
several initiatives aimed at tackling illicit 
European Commission's (EC) 2020 AML Acti 


six areas 


financial 


maturity 
member 


between 


mature finan 
S paper. 


thi 


enforcemen 


standardiza 
cooperation 
the EC issued a legisla 


priorities set 
on public pri 


a 
m 

the European Public Prosecu 
tackling comp 

m 


and supervisi 


may impact 


EU 
fina 


of focus including the creation of a 


tion of AM 


crime across 


ex 


on is understan 


vate partnerships (PPPs 
the bloc." 


L supervision through 
EU level supervisory body, the developm 
and enhanced coordination 
tive proposal takin 
out in the Action Plan wi 


be 


) has launched 
ncial flows. The 


on Plan set out 


single rule book, 
the creation of an 


ent of public/private 


tween FIUs.'° In 2021, 


g forward many of the 
th a separate consultation 


and th 


eir role in combatting 


addition to its efforts to enhance the financial crime risk 
anagement framework at the policy level, the EU has created 
tor’s Office, which is charged with 
financial crimes against the EU budget in a 
ore coordinated manner. The EU focus on standardization 
dable given the differing levels of 


in financial crime frameworks and approaches across 


states. It remains to 


the developmen 
the 


be seen how policy changes 

t of collaborative ways of working 
public and private sectors that is a feature of more 
cial crime frameworks, which is discussed further in 


. Singapore: Financial crime risk management, compliance and 
t continues to remain a top priority for Singapore. 


The Monetary Authority of Singapore (MAS) persists with its 
supervisory efforts around robust execution of financial crime 


and advanced data analytics. 


The Singapore government is one of the global 
cryptocurrency regulations to mitigate the mon 
terrorism financing risks associated with 
passed the Payment Services Act (PS Act) in Jan 
requires entities that deal in and/or facil 
digital payment tokens (DPT 


risk management in Fls and in encouraging the 


Such providers of DPT services are required 
AML/CFT requirements which incl 


assessments, perform Cus 
itor and report suspicious 
in Par 
the scope of regulated D 
fer of 


and mon 
to the PS 
enhance 
custodia 


Act were passed"? 


services and trans 


In keepin 


g with the theme of 


transacti 


ons, the MAS pub 


regu 


ished in J 


ia 
a 


ude th 
tomer Due Di 


transact 


use of technology 


eaders in passing 
ey laundering and 


these assets. The MAS 


uary 2020, which 


itate the exchange of 
T) to hold a payment services 


icence. 
to comply with 


e need to conduct risk 
ligence (CDD) measures 


ions. Amendments 


ment in January 2021 to 
| services, and include 
DPTs. 


ating cross-border 
une 2021 a consultation 


paper’? on AML/CFT requirements applicable to cross-border 


business 


arrangements between ca 
and their foreign related corporatio 


pital ma 


ns (FRC), 


rkets intermediaries 
their foreign head 


offices, or foreign branches, under Singapore's Securities and 


Futures Act (SFA) and Finan 


cial Advisers Act (FAA). Singapore 


Fls will be provided a transition period of six months to comply 
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with the requirement to have policies and procedures in place to 
oversee the conduct of FRC or foreign offices. These include (i) 
record-keeping - CDD and Transaction Monitoring information 
must be kept for at least five years; (ii) internal policies are to be 
updated relating to CDD and Transaction Monitoring; and (iii) 
provision of CDD/Transaction Monitoring Records upon request. 


n October 2021, the MAS announced that it will implement a 
digital platform and an enabling regulatory framework for Fls to 
share with one another relevant information on customers and 
transactions to prevent ML, TF, and proliferation finance (PF). The 
new digital platform, named COSMIC, for “Collaborative Sharing 
of ML/TF Information & Cases”, will enable Fls to securely share 
information on customers or transactions where they cross 
material risk thresholds. It aims to support Fls to identify and 
disrupt illicit networks and enhance SARs. The information is 
shared in a structured data format and is designed to integrate 
with data analytics tools to help Fils collaborate productively and 
at scale. The sharing creates an enriched data pool of higher 

risk activities and customers that Fls can use to dynamically 
assess Customer risks and that MAS will use in risk surveillance 
to detect illicit networks to target for supervisory interventions. 
In its consultation paper,'* MAS explained that it will require 
participant Fls to implement robust measures to safeguard 
against unauthorized use and disclosure of COSMIC information. 


United Kingdom: The United Kingdom (UK) has continued to 
drive enhancements to its financial crime framework through 
the delivery of the Economic Crime Plan. Significant investments 
are slated, to build FIU capacity and capability, and to bolster 
the capabilities of the national fraud reporting service, however 
these investments come against a backdrop of significant 
increases in SAR volumes and reported frauds. 


Her Majesty’s Treasury (HM Treasury) is undertaking two financial 
crime-related consultations. The first is to make time-sensitive 
changes to regulations to enhance clarity in certain areas and 
ensure compliance with international standards. The second 
is amuch broader consultation, seeking stakeholder views on 
the overall effectiveness of the AML regime, including on the 
potential value of new concepts such as the introduction of 
national priorities similar to those set out in the US AMLA, while 
also assessing whether key elements are operating as intended 


The Home Office is also expected to consult on potential changes 
to AML and information sharing legislation in 2021. Between 

both consultations, there are significant opportunities for 
stakeholders to work collectively to drive effective financial crime 
reforms in the UK. 


6. Other global examples: Though 
some specific international and jur 


this paper highlights above 
isdictional examples that 


encompass major structural change in AML/CFT rules and 


supervision, there have been deve 


opments across other 


countries and regions which merit significant attention, and 


which could be replicated in other 
closely across global reform efforts. 


In Australia, the Australian Fintel Al 


places or connected more 


iance continues to bring 


together increasing numbers of banks, remittance service 
providers, and gambling operators, as well as law enforcement 
and security agencies, to share intelligence and develop solutions 
on preventing and disrupting financial crime. Investments have 
also been allocated to enhancing reporting systems for Fls to 
streamline compliance and drive more timely and effective 
financial intelligence. A parliamentary committee is examining the 
adequacy and efficacy of the national AML/CFT regime and will 


report later this year. 


ore broadly in the Middle East, North Africa, and Sub-Saharan 
Africa, there is a continued focus on technical assistance and 
training through organizations such as Middle East and North 
Africa Financial Action Task Force (MENAFATF) and on building 
information sharing capabilities. These include efforts such as 
the MANSA CDD platform in Africa, which has been established 
by a partnership of private sector and central banks to provide 
a single source of primary data required to conduct CDD on 
African entities in order to alter risk perceptions, address de- 
risking on the continent, and promote trade in Africa. PPPs 

are being established or are operating in multiple jurisdictions 
including, for example, in Hong Kong (the Fraud and Money 


Laundering Intelligence Taskforce), South Africa (the Anti-Money 
Laundering Integrated Taskforce), and Canada (Project Protect). 


Several jurisdictions within Europe are also innovating to 
enhance their response to financial crime beyond the EU- 


focused reform initiatives no 
five banks and Finanspolisen 
FIU - formed the Swedish An 
Task Force (SAMLIT), which is 


operational information, with 
banks in that effort. 


ted herein. For instance, in Sweden, 
Rikskriminalpolisen — the Swedish 
ti- Money Laundering Intelligence 

a co-operation for the sharing of 
work ongoing to include more 


Other examples include the development of information sharing 
utility models such as ‘Transaction Monitoring Netherlands’ '® 
and Invidem in the Nordics'’. The Nordic and Baltic countries 
have also formed the Nordic Baltic AML/CFT Working Group, 
which is designed to allow authorities to exchange experiences 
and information on financial crime matters across countries and 
agree on measures to increase cooperation.”? 
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Part 2: A way forward on 
continuing to enhance 
effectiveness in financial crime 


risk management 


As recognized in Part 1 of this paper, a critical opportunity exists now to make meaningful changes in how th 
addresses illicit finance and to build upon the advancements of the past several decades. Momentum for reform is being driven by the 

collective need to mitigate and prevent financial crime consistently across borders and across industries and sectors. Building on the work 
that has already been undertaken and efforts which are currently underway, the following areas warrant fur 


through public and private sector cooperation and coordination: 


1. The use of financial intelligence 


The management of financial crime can be improved by 
facilitating the increased sharing of information, and by more 
effectively using financial activity, threat and risk data linked to 
crime and terrorism, both domestically and internationally.*! 
evertheless, issues such as inconsistent legal frameworks for 
data protection, the management of SAR type information, 
privacy and bank secrecy continue to present barriers that 
inhibit an effective intelligence-led approach to risk 
management. Building on the enablers identified in the 2019 
white paper, several key issues remain vital in developing a 
better anti-financial crime system and should be considered 
across reform efforts. 


a. Suspicious activity and transaction reporting 
Background 


The Suspicious Transaction Report (STR)/Suspicious Activity 
Report (SAR) regime is a cornerstone of the global financial 
crime risk management framework. However, there are a 
number of acknowledged challenges to its effective application. 
Legal frameworks penalize the “failure to report”, but do not 
generally sanction overreporting. This encourages reporting 


insti 


tutions to adopt a defensive reporting post 


e global financial community 


ther discussion and development 


ure, which 


— juxtaposed with a low threshold for “suspicion”, and an 


all-c 


rimes approach - drives u 


p SAR volumes wi 


commensurate gains in repor 
outcomes - for example, increased prosecution 


seiz 


tran 


sec 


High vol 


jurisdicti 


ures. 


sign 


thout delivering 


ting quality or improved 


s or asset 


umes of low-value reporting (whether that be specific 
sactional data and/or suspicious activity, depending on the 
on), consumes resources in both the public and private 
tors in terms of production and review. Often such 
resources could be more effectively deployed elsewhere to 
focus on higher-value activities. It also creates risks that a 
ificant number of innocent parties are reported to, and 
recorded in, government databases in a manner that sits 
uncomfortably with the concepts of proportionality and 


necessity enshrined in most jurisdictions’ data privacy laws 


These challenges are amp 
sharing, and prioritizatio 
sectors are U 


ified where feedback, information 
n between the public and private 
nderdeveloped and do not support or inform the 


accurate identification of suspicion or the effective application 


of the risk-based approach and can mean reporting institutions 


may not know which SARs 


are of high value to the FIU. They can 


be exacerbated further in jurisdictions where supervisory 
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frameworks do not prioritize quality over quantity, and do not 
allow efforts to be dialed up or down against mutually agreed 
threats or priorities - or points of integration of funds such as can 
be set out in “Geographical Targeting Orders”. 


A further challenge is that any incident of serious crime is often 
inherently multi-national in nature and has touchpoints across 
multiple institutions. Against this reality, approaches to data and 
information sharing (including the sharing of SARs) are often 
limited by national and organizational borders that can only be 
bridged through processes and arrangements that operate with 
far less agility than that exhibited and leveraged by crimina 
networks. 


This challenge is thrown into sharp perspective when viewed 
through the lens of a major international FI. It is well recognized 
that such institutions can potentially see a complete network of 
suspicious activity across their global data, but limitations on 
international information sharing often prohibit this global view 
being shared with a single (or group) of national law enforcement 
bodies. 


This challenge persists even where intra-group sharing—which 
has been very usefully encouraged by the proactive stance taken 
on Recommendation 18 by the FATF?? —has been supported by 
guidance at the national level.2? As such, it remains the case that 
group wide sharing is not yet synonymous with group wide filing, 
and so while all the component parts of a comprehensive 
intelligence picture may exist in the system, they are rarely — if 
ever — assembled into a complete understanding, and certainly 
not at pace. 


To overcome these issues, SAR mechanisms should be reformed 
in practical ways to enable them to become more effective. Taken 
together, these reforms have the potential to increase the focus 
and quality of SAR reporting and the overall effectiveness of the 
financial crime framework. Where progress is noted, global 
policymakers are encouraged to take similarly proactive steps to 
work with public and private sector stakeholders to identify 
opportunities to enhance effectiveness in their own jurisdictions. 


Recommendations 


First, it is important that governments and FIlUs continue to 
commit sufficient resources (human and technological), to the 
collective analysis of SARs and STRs, with a specific focus on 
enhancing the speed, volume, and quality of feedback on threats 
and typologies provided to suspicious activity reporters. 
Enhanced and timely feedback should be specific, focused, and 
actionable, for example identifying common payment patterns of 


concern that identified by multiple reporters, to help the 
reporting sector refine the focus of its AML controls, and help the 
system as a whole prevent, detect, and respond to financial 


crime more efficiently 


Second, enhanced SA 
indicators, could form 


cases and 
into a set of national fi 


in the U 
significant beneficia 


The flexibility to enable institutions to dial eff 


assessment process. This SAR analysis sh 
insight derived from in-depth law enforcement analysis of key 


investigations which together could, in time, translate 


and effectively. 


R analysis by FlUs including efficacy 


a key 


input into a national threat 
ould be enriched with 


nancial crime priorities agreed collectively 


between stakeholders; a concept that has now, for example, 

been established in the US through the implementation of the 
US AMLA, and is an idea also being consu 
. The implementation of nationa 
impact on the effect 
regime, if supported by reforms to the supervisory framework 
that could enable reporting efforts to be dia 
focus, and dialed down proportionately in non-priority areas. 


Ited on by HM Treasury 
| prioriti 
iveness of the SAR 


es could have a 


ed up in areas of 


ort up and down to 


reflect priorities as part of an increasingly outcome-focused 


regime is cri 
priority areas there ca 


nnot be a zero-toleran 


tical, as is a recognition that in focusing effort on 


ce approach to 


reporting against low-priority areas. Without such flexibility, the 


introduction of national priorities could crea 


te additional 


reporting burdens, without reducing the high volumes of low 
value reporting that are currently a feature of most SAR regimes. 


The effective impleme 


ntation of national priorities affects a 


broad range of financial crime matters and is discussed more 


widely and in more de 


Third, SAR framework 
reporting entities to th 


exist and limited information an 


the public and private 


FIU. 


ess importance. 


at all clear what inform 


s rely on 
e FIU. Where national 


tail in Section 2. Risk Prioritization. 


information being pushed from 


priorities do not 


d feedback is shared between 
sectors, reporting institutions may not be 
ation is of value to law enforcement or the 


Even where reporting entities do have a good understanding of 
threats and risks, regulatory frameworks and examination 
approaches mandate an all-crimes approach, thereby providing 
ittle latitude for reporters to dial up SAR reporting efforts 
against areas of importance, and to dial down efforts in areas of 


Where specific and targeted national priorities are not in place, 
policymakers could reconsider the balance between “push and 


pull” in the SAR framework. The current, “one size fits a 


” 


approach to reporting might be replaced with a streamlined 
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reporting obligation, in which reporters would only be required 
to provide high-level “notifications of suspicion” to the FIU, limited 
to core customer data and a synopsis of the suspicion. Such an 
approach would be entirely consistent with the risk-based 
approach. Over time this process could become increasingly or 
entirely automated (e.g., in SARs relating to structuring or 
unusual deposits or withdrawals, generated primarily due to 
automatic detection of such payments). 


f data within the “notification of suspicion” was of interest to the 
FIU or law enforcement (e.g., hitting a flagged investigation), the 
FIU or law enforcement could request further investigation by 
the reporting entity. The bulk of a reporter's investigative 
capability would be held in reserve to support such proactive 
requests from law enforcement/FIU, ensuring analytical and 
investigative effort within the regulated sector was focused on 
developing intelligence on matters of genuine concern or interest 
to law enforcement. This process would allow national 
frameworks to retain an all-crimes approach, while minimizing 
analytical effort invested in low value reporting. 


Fourth, nations with a commitment to tackling complex financial 
crime should consider how a global Fl's potentially 
comprehensive insight into an instance of international financial 
crime could be shared as a complete SAR analysis in multiple 
jurisdictions, putting a comprehensive picture in the hands of 
investigators. 


Perfection should not be the enemy of progress in this context. It 
is fully accepted that achieving global consensus on information 
sharing cross-border is a hugely complex issue, but that should 
not deter likeminded nations, or groups of nations (such as the 
G7 or the “Five Eyes” Intelligence Alliance), from building bilateral 
or multilateral agreements to share aggregated SAR data relating 
to their jurisdictions in a single report that is filed simultaneously 
in multiple FlUs. Further discussion on bilateral and multilateral 
cooperation is considered in Section 4. International Cooperation 
and Capacity Building. 


Progress in policy discussions around bilateral/multilateral SAR 
filing should be supported by parallel collaboration on data 
standards and the development of common SAR templates that 
would help accelerate data integration and analysis, as well as 
the possible inclusion of unique identifiers such as digital IDs t 
identify cross-border activity on persons of interest, without 
sharing personal data where no activity/corresponding SAR 
exists. 


ie) 


In addition to avoiding geographical silos, it is also important that 
organizational structures within Fls - for example between AML, 


cyber and fraud teams - do not put barriers in place that 
undermine the development of a comprehensive understanding 
of criminals and criminal threats that operate across thematic 
silos. Expediting efforts to enhance data fusion across 
organizations is a key enabler in the development of a 
comprehensive global SAR. 


b. Beneficial ownership reporting transparency 


Background 
Transparency of beneficial ownership and the reporting of that 
data is a critical tool in fighting all forms of illicit finance, from 
fraud to money laundering and corruption. Transparency of 
beneficial ownership can also help promote prosperity by 
building trust and clarity for financial transactions and 
nvestment. 


Though the concept of beneficial ownership registries is 
embedded in FATF Recommendation 24 (R.24), there is uneven 
progress in implementation across the globe. Where 

it is made available, a common theme is that the data is held 
and maintained by a public body that lacks the mandate, as 
well as the necessary financial and human resources, to 
effectively assure the quality of the data. This issue needs to 
be addressed through both policy change and investment 
creating a single source of reliable truth. 


Though the FATF is currently consulting with its member 
jurisdictions and other stakeholders on amendments to R.24%4 
and while implementation and enhancement to registries 

are underway at various speeds across the globe, a few key 
issues should be addressed to enhance international coherence 
in the design and operation of beneficial ownership information 
reporting. Given recent developments such as the data leak 
around the “Pandora Papers,”’° it is evident there is a lack 

of transparency in the international system; countries should \ 
make reform in this area top priority in line with the 
commitments of the G20 and other international bodies. 


Recommendations 


First, Fils should not be primarily relied upon to verify the 
information in beneficial ownership registries, to act as 
gatekeepers, or to depend on discrepancy reporting as a means 
of validation. There should be increased emphasis on requiring 
the legal entities themselves (including corporate entities and 
other forms of incorporation such as, among others, trusts and 
partnerships) to satisfy CDD requirements in a verifiable way, 
with commensurate penalties for non-compliance. 
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Second, in order for the registry to be reliable, it is important 
to be clear in R.24 that the public sector stands by the contextual 


reference data they 


effective ris 
context, having sign 


management. The issue of rel 


compliance processes (e.g., CDD, and/or ongo 


across multiple insti 


tutions, potentially releasi 


provide, ensuring it is a source upon which 
the regulated sector can rely both practica 
integrity of the verification informa 


ly and legally ifthe 
tion is appropriate for 
iance is key in this 
ificant potential to reduce 


duplicative 
ing due diligence) 
ng significant 


capacity that could be refocused on higher value activities. 
Fls should not be expected to ensure the qual 


maintained in a beneficial ownershi 
reporting should not be relied upon 


Third, access to beneficial ownershi 
made available first and foremost 
legitimate purpose for needing this 
regulatory bodies, law en 
nformation and genuine 
are key considerations which shou 


to those wh 


data privacy/protecti 


ity of information 


p registry and discrepancy 
as a means of validation. 


p information should be 


ohavea 


information, such as FIUs, 
forcement and Fls. Security of 


on concerns 


d be considered when 


considering access to registries.?6 This will require coordination 


with and the cooperation of national agencies 


responsible for 


privacy regulation. Based on this, tiered access for legitimate 


interest by other stakeho 


ders beyond compe 


and Fls could be considered. 


tent authorities 


Fourth, it is important that further work is undertaken to 
ensure that inconsistencies in national approa 
ownership information accessibility and repor 
Operational burdens with little to no risk management value 


arise when countries imp 
to yield the same results. 


ches to beneficial 
ting are mitigated. 


ement different requirements that seek 
Country coordination on common 


standards would improve both efficiency and effectiveness in risk 


mitigation by Fls and would a 


financial system. It will also aid cross-border in 
and network analysis in FlUs if there were common fields/\ 


tandards that enab 


n 


FATF has a significan 


ed the registers to be 


include a regular revi 


re mitigated, includi 


t opportunity to enhance 


ew of registries to ensure 
ng the use of false documentation or 

inaccurate identities to hide beneficial ownership interests.” 
However, it is also incumbent on countries 
weak spots and address the issues noted h 


so further protect the global 


vestigations 


nitted together. 


the effectiveness 


of jurisdictional beneficial ownership registries by ensuring high 
standards are in place internationally through 
a 


R.24 which 
weak spots 


to act now to identify 
erein. 


The UK provides an interesting and positive example in this 


context. The UK registry - Companies House — has mapped out 
a clear strategy to transform its remit from that of a passive 


registry to one where it will be an active participant in the 


anti-financial crime community. Companies 


House will build 


capacity - both human and technological - to engage in the 
proactive analysis of data to identify and share strategic and 
tactical intelligence on crime. Critically, Companies House will 


itself take a degree of responsibility for the i 
verification of beneficial owners. 


= 


While organized criminals will indubitably re 


reforms by seeking new ways to try to undermine the integrity 
of the system, (e.g., using “mule directors”, acting as fronts 


to hide genuine beneficial owners), these ris 
by proactive information sharing by Compa 
emerging typologies and risk. As such, thes 


n 
e 

a welcome strategic repositioning of the role of the company 
m 


registry in the anti-financial crime ecosyste 


dentification and 


spond to these 


Ss can be mitigated 
es House around 
reforms represent 


putting beneficial 


ownership at the heart of the collective response to illicit finance 


in a way that can help substantially to prevent and detect the 
criminal abuse of company formation. Ambitious reforms like 


those proposed by Companies House shou 


d be monitored and, 


if successful might be emulated internationally. 


c. Data utility models 


Background 


It is vital that best use is made of the capacity that exists in 


the global financial crime ecosystem. Financ 


ial crime risk 


management frameworks globally should enable and encourage 


modernizations that have the potential to m 


inimize low-value 


activities so that capacity can be more usefully focused on 
other, mutually agreed, higher-value activities with greater 


potential to deliver positive outcomes. 


Data and information utilities are important 


in this context, 


which, for the purposes of this paper, we define as mechanisms 


that either allow duplicative processes to be 
on behalf of many (e.g., KYC utility), or which 


undertaken once 
allow siloed datasets 


to be brought together in information sharing utilities (both 
publicto-private and private-to-private), either through data 
pooling, or through the use of collaborative analytics, to 


enhance the efficiency and effectiveness of ris 
functions (e.g., a transaction monitoring utility 


also has significant potential 
mutualized data (a form of utility), at the hea 
prevention.”® 


management 
. Digital identity 


to be an important category of 


rt of financial crime 


Fulfilling KYC obligations might be considered an inefficient 
process when assessed at the whole-system level. Developing an 
approach that would allow this process to be undertaken once 
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on behalf of all stakeholders could release huge volumes of capacity 
for reinvestment in other activities, such as participation in PPP and 
investment in enhanced analytics. 


Anumber of jurisdictions have trialed the development of KYC utilities, 
most notably in the Nordic region, in Africa and in Singapore. Pilots 
to-date have identified significant complexities around issues such 
as the agreement of common standards between participants, the 
availably of “golden data sources” (and to what extent they can 
be relied on in a regulatory context), information technology, 

implementation costs, and the rationalization of legal complications 
around issues such as the processing of personal data. 


These challenges have sometimes slowed or stopped progress. 
However, they are potentially surmountable over time, especially if 
lessons learned through both successful and unsuccessful pilots 
are captured and shared widely and, with the encouragement of 
regulators and policymakers, are used to inform the development 
of future efforts to build innovative solutions to address this 
duplicative and resource-intensive element of the financial crime 
framework. 


There have been a number of interesting developments in the field of 
information sharing utilities since the analysis in 2019. For example: 


* Inthe Netherlands, through Transaction Monitoring Netherlands 
(TMNL), five major banks are piloting collective transaction 
monitoring of combined pseudonymized transaction data to 
identify unusual patterns of cross-bank activity relating to money 
aundering. The immediate goal is to enhance the effectiveness 
of the participating banks’ efforts against financial crime, with a 
potential end state being the development of an industry-wide 
utility performing transaction monitoring activities on behalf of 
the Fls involved. While TMNL is a private sector-led initiative, the 
banks have sought active cooperation with stakeholders in the 
public sector to build the TMNL platform. For example, detailed 
typological input has also been provided by the Dutch FIU. 7° 


nthe UK, the Tribank*? pilot pooled transactional data from three 
banks in pseudonymized form. This was successfully combined 
into a meaningful dataset over which centralized analytics could be 
pplied to reveal suspicious patterns of activity for further review 


* In Switzerland, a number of major banks are working together to 
establish a utility for sharing data for AML alert mitigation. The 
goal is to create a model that includes agreed systematic triggers 
which, in the future, would allow the banks to share KYCderived 
information to drive timely improvements in data quality and 
the effectiveness of operation models. A legal assessment was 
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Other countries testing information-sharing uti 
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Second, the use of regulatory sandboxes (e.g., the sandbox run 

by the Financial Conduct Authority (FCA) in the UK ) is important 

n this context. There are already leading examples of information 
regulators and financial conduct regulators using the sandbox 
concept to help encourage innovation. When considering 
nformation-sharing utilities, however, it will often be the case that 
participants will come up against issues that are relevant to both 
types of regulators (and potentially issues relating to the handling of 
FIU data as well). 


As such, it is important that—at a minimum—information and 
financial crime regulators, supervisors, and examiners work 
closely together to help create the conditions in which innovation 
can flourish. They could also consider working together on the 
development of experimental collaborative sandboxes through 
which all potential legal and regulatory challenges relating to 
information-sharing utilities could be considered and addressed 
comprehensively to help accelerate innovation. For this to be most 
effective, financial crime regulators themselves may need to invest 
in appropriate expertise in order to facilitate the acceptance of new 
innovation. 


any of the challenges around utilities relate to the need to bring 
together siloed data. However, there are points in the ecosystem 
where data is already aggregated to various degrees including, for 
example, the national payments architecture, national settlement 
systems, and the correspondent payments networks. Stakeholders 
in the financial crime ecosystem should collaborate to explore 

ways to test how centralized financial crime analytics could be run 
across existing points of data aggregation (e.g., a national payments 
architecture) to identify and disrupt suspicious patterns of activity 


Third, there should be further exploration on points of aggregation. 


efficiently and effectively - including patterns that could not be 
identified by analyzing data within organizational silos. 


tis highly encouraging that the use of the payments architecture 
to tackle crime is noted as an ambition by some policymakers,*® 
although the implicit focus is on using the payments architecture 

to “design out” fraud. This is an entirely laudable aim and an 
understandable priority, but public and private sector stakeholders 
should seek to ensure that the potential dividends of investing in 
centralized analytical capabilities are fully explored in the context 
of tackling a much wider set of economic crimes, including money 
laundering, tax evasion, and other predicate offenses. 


d. Public-private partnerships 
Background 


A PPP - a collaboration between Fls, law enforcement, policymakers, 
and the regulatory community - has become an important and 
growing component in global financial crime frameworks. A detailed 
analysis of the rationale behind the establishment of PPPs, and the 
value they can add was included in the 2019 white paper. 


Since the inception of the UK Joint Money Laundering Intelligence 
Taskforce (JMLIT) in 2014, PPPs to enable the sharing of intelligence 
and information have been established in over twenty countries 
across Asia Pacific, the Americas and Europe. In addition, a number 
of “single issue” PPP initiatives have been established, bringing 
diverse stakeholders together to improve the response to specific 
threats such as wildlife trafficking. Meanwhile, Europol’s Financial 
Intelligence Public Private Partnership (EFIPPP) has continued to 
develop its role as the first multilateral PPP. 
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The growth in PPP has also been encouraged by the FATF in policy 


statements and through the Mutual Evaluation 
sus that by developing fra 
enable more intelligence and insight to flow be 
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prevent criminal misuse of the financial system 
relationship between sta 
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Recommendations 
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nts in their development, 


national and supranational policymakers could encourage PPP 
models to develop over time in several ways, including: 


* From a policy perspective, PPP should be embedded within the 
financial crime policy architecture at the national level to ensure 
that insight and input from across the stakeholder community is 
captured and used to drive development of effective legislation 


and regulation. 


* At the strategic level, PPPs should be used to drive exponential 
growth in the development and distribution of strategic 
intelligence products and typologies. This intelligence should be 
shared at scale to help inform the effective application of the 
risk-based approach and to drive consequential improvements in 
prevention, detection, and reporting. 


At the tactical level, PPPs shou 


d find ways to share operational 


intelligence between stakeholders to expedite investigation and 


drive outcomes. Tactical 
governance frameworks 


information-sharing demands robust 
and clear legal gateways, but it is vital 


in driving both effective outcomes against priority threats, and 


in providing the building 


typologies. 


Second, PPPs of all kinds h 


blocks in the development of good 


ave demonstrated their value. They 


have built trust and collaboration across stakeholder communities 


and improved the focus an 


d quality of SAR reporting. PPPs have 


empowered the risk-based approach, provided stakeholders with 
access to new intelligence and better insights, and helped to deliver 
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Fourth, PPP leaders should consider how they can tailor 

engagement with members to build a model that finds the right 
balance between data coverage and agility. As PPPs establish and 
grow both through the passage of time and the delivery of reforms 
such as those described above, there will be natural pressure to 
expand membership. This pressure exists for a range of reasons 
including that increasing membership can be used as a proxy 
measure of success; that growing membership reduces perceptions 
of unfairness or favoritism; and, simply, that it instinctively seems 
ogical that a greater number of members means more access to 
intelligence and better insight. 


However, growth also brings challenges. A wider membership can 
increase governance and administration overheads. It can also make 
obtaining a consensus difficult, which can inhibit innovation, and 

it can divert focus from core priorities through pressure to ensure 

a steady flow of cases or typologies that are sufficiently relevant 

to all. Most fundamentally, growth for growth's sake can impede 

the development of trust. For example, in the context of tactical 
information-sharing partnerships, law enforcement may be less 
willing to share sensitive case data as membership expands. 


An effective PPP model could include tiered membership, blending 
light touch engagement across a broad range of institutions and 
sectors, with a smaller set of deeper relationships with a number 

of core members. Membership of the core would need to reflect 
agreed priorities and could be cross-sector where required (€.g., 
where scams are a priority threat, engagement with online platform 
providers would be key to knitting the online and financial networks 
together). The core would also need to be sufficiently flexible to 
respond to changes in the market (such as the emergence of virtual 
assets) but would almost certainly include the relatively small 
subset of Fls that in most jurisdictions sit across the vast majority of 
financial information and intelligence in the ecosystem. 


Due to their scale, these organizations would likely have a touchpoint 
most cases, the capability to conduct high-quality analysis and 
vestigation at pace in support of the partnership, and the capacity 
to back the development of new and more effective ways of working, 
such as physical co-location and the development of innovative 
approaches to bulk data-sharing and collective intelligence-led 
analytics. By keeping the core at a manageable size, the group 

would be more agile in its response to threats and development of 
nnovation. 


3 5. 


It would be imperative in such a model that insights obtained by a 
core group working closely together were routinely captured and 
shared with the wider regulated sector. This would help to manage 


perceptions of unfairness and inform the effective application of the 
risk-based approach more widely and enable collective prevention 
at scale. 


Fifth, public and private sector stakeholders should continue to 
drive efforts to encourage and enable PPPs to collaborate cross 
border. Similarly, it is important that where single issue PPPs exist, 
they work closely with national PPPs in order to share insights 
against potential areas of overlap (e.g., routes and techniques 
used in trade-based money laundering and environmental crime) 
and ensure that shared learning is not lost by looking at issues in 
isolation. 


Sixth, PPP participants should explore the development of digital 
typologies. By combining traditional law enforcement skillsets with 
participation from technologists, PPPs may be able to move from 
paper-based typologies to the creation of digital typologies, coded 
as a set of rules, that could be more easily and quickly ingested into 
the transaction monitoring systems of a wider range of institutions. 
This could help to ensure that the biggest collection and detection 
capability in the financial crime ecosystem (i.e., the transaction 
monitoring systems at Fls) was better able to more accurately and 
quickly prevent, detect and report crime. 


va) 


e. Data protection and security issues 
Background 


Issues concerning tensions between data protection and information 
sharing are not new and cut across nearly all areas outlined in this 
section relating to the use of data and financial intelligence. They 
also concern other relevant areas of discussion, including issues for 
risk prioritization in Section 2 and the adoption of new technology 

in Section 3. Real or perceived friction between data exchange 
and rules related to data protection, privacy and confidentiality 

are recognized as potentially restricting or prohibiting information 
sharing on matters concerning money laundering, terrorist financing 
and other threats. However, while the protection of customer/ 
personal data and the right to privacy are of unquestioned 
importance, the upholding of such principles does not exclude 
sharing information on illicit financial activity in a safe and secure 
way. Getting this balance right is therefore critical. 


To make progress in overcoming such difficulties and to broaden the 
ability to share valuable information amongst Fls, law enforcement, 
and regulators on a cross-border basis a few key issues should be 
considered. 
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Recommendations 


First, the FATF made substantive progress in this area when it 
adopted revisions to FATF Recommendation 2 (R.2) on national 
cooperation and coordination. The amendments expanded 

the Recommendation to include information sharing between 
competent authorities and emphasized that cooperation should 
include coordination with the relevant authorities to ensure the 
compatibility of AML/CFT requirements with Data Protection and 
Privacy (DPP) secrecy rules and other similar provisions (e.g., data 
security/localization). *° 


Once enacted jurisdictionally, this change should help to make 

sure AML/CFT and DPP rules are accordant and should assist in 
facilitating exchange of information within the private sector and 
between governments and the private sector. The FATF itself is 
encouraged to continue to rigorously review national adoption 
through criteria which reviews efficacy in line with the FATF’s overall 
objectives. The utility of any Recommendation change is only as 
good as both its practical application in national rulebooks/guidance 
and its actual, measurable results in line with both the letter and 
spirit of the revisions. 


In this regard, there should be further focus on whether the 
outcomes of cooperation have led to changes or clarifications 
in laws/regulations and material growth in gateways to data 
exchange. This will likely be the ultimate test as to whether the 
Recommendation actually supports real progress. *° 


Second, there should be a wider, global focus on addressing the real 
or perceived tensions between data protection laws and information 
exchange for financial crime matters on a cross-border basis, and 

in developing a clear mutual understanding between stakeholders. 
The FATF, for example, has found there is a noted lack of interaction 
between national and international AML/CFT and DPP authorities. 
Such lack of coordination and cooperation might also impede the 
efficacy of R.2, noted above. 


Building on the national-level dialogues mandated through R.2, 
support should be built on a global basis for an AML/CFT/DPP Forum 
organized through the FATF, which brings together data protection 
and financial crime authorities across countries to work on ways 

to facilitate cross-border exchange of information. The outcome of 
such a process could drive principles that help reconcile differences 
in approach and develop solutions leading to determinations of 
equivalence, or in appropriate cases, mutual recognition of laws 

and regulations aiming to achieve the same purpose of protecting 
against financial criminality while upholding data protection and 
security. This may lead to an enhanced, meaningful exchange of 
financial crime information, not just between governments but also 
between Fis, between governments and Fls, and within Fls across 
jurisdictions. 
FATF could prioritize this work through its current project related 

to data pooling, data analytics and data protection.** The FATF 
have taken a vital step through that project in recognizing that 
AML/CFT and DPP are both significant public interests that serve 
important objectives, which are neither in opposition nor inherently 
contradictory.*? Indeed, they can be complementary, with the 
greater the targeted intelligence shared, the more precise the 
reporting can be. This would lead to less intrusion into private 
sources and less overreporting of non-pertinent information. 


The FATF have also recognized that while DPP laws may differ 
between each jurisdiction, there is a trend toward convergence.** 
This trend could be capitalized upon through a cross-border 
AML/CFT/DPP Forum that supports the objectives noted herein 
with outcomes that can be relied upon as an optimum means for 
enhancing legal gateways. 


It is also important to reconcile work at the FATF level on these 
issues with work underway at the behest of the G20 concerning 
enhancements to cross-border payments. The G20 building blocks 
on how payment system improvements could be achieved includes 
reviewing the interaction between data frameworks and data 
protection in conjunction with AML/CFT requirements. The building 
blocks report raises the difficulties that can come from underlying 
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legal frameworks and the challenges coordinating and securing 
support for alignment with international rules, standards, and 
cooperative supervision and oversight arrangements. Addressing 
these impediments through a global AML/CFT/DPP Forum may help 
achieve the wider objectives of the G20 through greater alignment 
and clarity in laws and regulations across borders. 


Third, the issues of data protection and financial crime information 
sharing should not be discussed in siloed conditions. The wider 
matters of privacy are often considered issues of human rights and 
should be reflected in the broader dialogue involving the general 
public whose information is held across Fls and by competent 
authorities. *° 


As such, it is extremely important for key actors at both the public 


nd private sector levels to engage with 


civil society in a proactive 


a 
discourse on the benefits that can be derived from appropriately 
sharing information on financial crime matters within the context 
of DPP frameworks. This dialogue should take two forms: first, an 
assurance that data privacy and data minimization principles wil 
upheld to the highest degree while achieving the goals of protecting 
society and financial stability from the effects of financial crime; 
and second, addressing general concerns that information-sharing 
could lead to further financial exclusion of segments of society, 
exacerbating de-risking issues which have been at the forefront of 
policy discussions for many years. 


The second point is particularly important to address in the context 
of emerging markets, and greater care should be taken in ensuring 


that the benefits of information sharing are taken into consideration. 


For instance, it has been noted that improving data sharing on 

a cross-border basis can actually lead to more targeted risk 
assessments by Fls, thus helping to deter wholesale reassessment 
of client coverage based on inadequate information.*® The Financial 
Stability Institute (FSI) has emphasized that improved cooperation 
on information sharing can help to reduce unwarranted de-risking, 
which would further aid in enhancing financial inclusion.*’ 


As noted in Part 1 of this paper, Singapore has taken a highly 
measured approach to assessing and addressing information- 
sharing challenges in their jurisdiction, and a focus on the 
concerns of civil society is very much at the forefront of delivering 
improvements to the financial crime framework.*® As policymakers 
around the world further examine the means of tackling the critical 
issues concerning DPP and AML/CFT, incorporating civil society 
into the discussions will help ensure the objectives of all parties are 
addressed while moving toward effective change for the benefit of 
society and stability. 


2. Risk prioritization 


Background 


The relative maturity of financial crime frameworks across different 


jurisdictions will vary, as will leve 


s of trust and confidence between 


system stakeholders. In jurisdictions that are less mature, the focus 
of policymakers, regulators and supervisors both domestically 
and internationally should remain on ensuring the effective 


implementation of global standards into na 


tional AML/CFT 


frameworks to build a solid foundation for the risk-based approach. 
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priority risks including driving the use of data analytics to strengthen 
detection and reporting in these areas. 
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In order to 


identify, evaluate, and mitigate risks associated with the 


national priorities, Fils should consider how they will adjust their risk 
assessment processes to focus more closely on applicable priorities 


and more rapidly understand and incorporate new information 
received from law enforcement and other sources in the future. 


Incorporating priorities into AML/CFT programs will likely require a 
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ikely have to dem 


onstrate to their 


internal auditors and examiners the reasoning behind why they 
stopped performing activities that they previously included in their 
policies and procedures, and why their programs remain compliant. 
Some Fis might be reluctant to stop activities (even ones producing 
little value, such as halting the review of alerts that do not identify 
suspicious activity) due to the concern of regulatory critique. 
Additionally, some Fils might determine that the burden of (and the 
time spent on) documenting why a particular activity was stopped is 
too onerous in terms of general resource allocation. 


As such, measuring effectiveness and enhancing the supervisory 
approach, including establishing clear guidance and expectations, 
will be critical. Although the risk-based, priorities-focused approach 
is a welcome reform, nothing will actually change until the 
supervisory and examination approach changes. It is critical that law 
enforcement, examiners, auditors, and other program evaluators, 
including Fls themselves, are on the same page in how to measure 
and evaluate AML/CFT program effectiveness. 


Examiners may need to consider shifting from utilizing a “check-the- 
box" supervisory approach (e.g., checking if the FI followed every 
step listed in its policies and procedures) to evaluating whether 

the Fl’s AML/CFT program is producing highly useful information 

for law enforcement and is managing and mitigating threats using 

a risk-based approach. For instance, examiners could assess the 
overall quality of the Fl’s policies and procedures instead of checking 
whether every element within the procedures was met, including 
elements that produce low-risk management value. 


Examiners could also consider assessing the effectiveness of the 
Fl's threat assessment and how effectively the FI integrated the 
applicable priorities into the Fl’s AML/CFT program. For instance, 
examiners could assess how the threat assessment informed 
adjustments within the AML/CFT program such as whether the FI 
reallocated resources toward priority areas and how the FI adjusted 
its KYC and transaction monitoring processes based on outputs 
from the threat assessment. 


nterms of adjustments to KYC processes, examiners could consider 
evaluating how the FI enhanced its onboarding, risk rating, periodic 
reviews and offboarding processes based on the level and type of 
threat exposure (e.g,, if there is a high cybercrime exposure, an FI 
should consider collecting IP addresses and incorporating them 
uring KYC and transaction monitoring reviews as appropriate). In 
ddition, examiners could evaluate how information collected during 
nboarding (e.g., nature and purpose of the account) is used to 
itigate exposure to risks based on the priorities. Also, if fraud is a 
ational priority, examiners could assess how information is shared 
etween the Fl’s AML and fraud departments if they are separate, 
istinct departments within the Fl. 
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government authorities (e.g., responses to court subpoenas); SARs the working group should publish a report on the lessons learned, 
filed related to the priorities; recognition from law enforcement provide leading industry practices, and make recommendations for 
related to the priority areas; and employee participation in trainingin — regulatory change. 

applicable priority areas.°° 


Both supervisors and Fls need to calibrate the respective goals 
of their supervision and AML/CFT programs to produce highly 
useful information - aligned with the national priorities — for law 
enforcement. Supervisors could achieve this by providing case 
studies as examples to demonstrate how an effective AML/CFT 
program should incorporate the national priorities. One method 
could be through national FIUs producing domesticfocused case 
books like the Egmont Group's Best Egmont Case Award for the 
benefit of all domestic Fls and stakeholders.®' The cases could 

be sanitized and aligned with the national priorities, providing Fls 
with technical assistance, training, information exchange related to 
leading practices, and developing trends in AML/CFT. These case 
books can then be shared with the international community through 
PPPs and international organizations with a level of detail that is 
helpful to actually accelerate building effective monitoring rules/ 
scenarios to identify activity. 


Fifth, there is a need to provide a platform to pilot, evaluate and 
refine the implementation of priorities into AML/CFT programs. The 
global AML/CFT community, including supervisors and examiners, 
should embrace pilots and a regulatory sandbox approach for 
evaluating potential new risk governance and compliance practices. 
The development, adoption, and implementation of a risk-based, 
priority focused approach will take time, and new risk governance 
and compliance practices should be developed to effectively address 
the national priorities. A pilot exercise would help facilitate the 
responsible development of new risk governance and compliance 
practices by Fls, and new examination approaches and procedures 
by examiners. 


National and local governments could consider developing AML/ 
CFT priority pilots to allow a cross-sector participation of institutions 
to develop and implement the approaches for incorporating the 
national priorities into their AML/CFT programs. In doing so, the 
selected Fis would have an opportunity to reallocate resources and 
staff to higher-value activities while collaborating with examiners and 
law enforcement who can provide real-time feedback. By focusing 
on areas where two or more stakeholders are involved (e.g., Fl and 
examiner, or two Fls for information sharing), the public and private 
sector can better identify and address barriers that exist between 
stakeholders. 


Throughout the pilot (which is another form of PPP), Fls, law 
enforcement and regulatory stakeholders should consider 
participating in a working group to share feedback on the pilot 
design, examiner evaluation process, and FI effectiveness in 
addressing national AML/CFT priorities. At the conclusion of the pilot, 
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3. Technology and innovation 
Background 


The challenges and opportunities inherent in the use of innovative 
technologies such as machine learning and advanced analytics were 
considered in the 2019 paper. Since that publication, the use of 
innovation to improve the overall effectiveness of financial crime risk 
management programs and disrupt illicit flows in high-risk areas has 
continued. Progress has been made in some jurisdictions, but also 
at the international level, in issuing guidance, statements of support, 
and in some cases passing legislation around emerging technology, 
with an overall goal of enabling innovation to enhance systemic AML/ 
CFT effectiveness. 


> 


The US AML Act, for example, makes innovation and the adoption 
of innovative approaches a regulatory imperative (e.g., ‘NextGen’ 
models that leverage behavioral analytics and machine learning 

to improve the effectiveness of financial crime monitoring and 
investigations). Innovation has also been encouraged in a number 
of countries through the use of regulatory ‘sandboxes’ that provide 
a safe space in which new approaches can be tested. The Financial 
Conduct Authority (FCA) in the UK has gone further, annually hosting 
a series of Financial Crime Tech Sprints to promote the use of 
emerging technologies that could combat money laundering and 
financial crime more effectively. 


Innovative information-sharing consortiums have received a 

degree of regulatory encouragement in Europe, specifically in 

the Netherlands with the development of an AML transaction 
monitoring consortium (TMNL), and in the Nordics through the 
establishment of a Joint KYC utility. In Singapore, the MAS has 
encouraged and supported the effective adoption of AML/CFT data 
analytics by Fls. These include solutions that apply machine learning 
and natural language processing techniques to replicate or enhance 
operationally intensive processes, such as analyzing name screening 
hits, priority ranking of transaction alerts for analyst reviews, and 
network linked analysis to assess higher-risk activities. 


Critically, at an international level, the German Presidency of the 
FATF has prioritized digital transformation in tackling AML/CFT. A 
coordinated, global focus on advancing technology in this area can 
help build coherence in approaches across jurisdictions and assist 
in the development of best practice in driving effectiveness and 
improving outcomes. 


However, challenges remain in the adoption and use of new 
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Second, emerging technologies can help an FI to aggregate and 
analyze significantly more data than in the past by using, for 
example, machine learning, Al, analytics tools, and data science. 
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broadly restricting 


the sharing of data, and the AML/CFT rules demanding it (at least in 
relation to suspicion). 
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As noted elsewhere in this paper, information sharing is a critical they should be successfully applied across a nation’s financial crime 
enabler in enhancing the effectiveness of all aspects of the fight risk management architecture and how they should be measured 
against financial crime. This applies absolutely in the context of regarding actual outcomes that disrupt the activities of money 
technology, where the development of potentially transformative aunders, fraudsters and other malign actors. Achieving uniformity 
capabilities and outpacing reforms to the legislative framework. As when it comes to measuring success for financial crime risk 
such, itis vital that stakeholders continue to focus their efforts toward management also stems from lack of uniformity at the jurisdictional 
defining and agreeing on the correct balance between DPP and AML/ evel in capturing outcomes of FATF Mutual Evaluations in national 
CFT rules at both the domestic and international levels to accelerate risk assessments. 
and enable appropriate technological innovation. 

The fundamentals of AML/CFT and the weaknesses of wider financial 
Privacy enhancing technologies (PETs) - specialist cryptographical crime prevention strategies across certain jurisdictions is the 
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Fourth, stakeholders should focus on increasing understanding Progress continues to be made, however, in these areas, as noted 
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contribute to better baseline risk and compliance functions. This measuring effectiveness as part of its Mutual Evaluation Processes, 
would likely include additional efforts by technologists to educate a key component assessing the use and impact of FATF standards 
regulators, policymakers, and Fls themselves, and would help ensure and identifying deficiencies in such areas as policy coordination, 
that the potential value of new technologies was fully understood, the application of preventative measures, and approaches to 
helping to accelerate policy reform to enable their use. The FATF investigation and prosecutions. Through the broader G-20 work on 
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offered to the public and private sectors on increasing AML/CFT ivergent implementation of AML/CFT requirements is also being 
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